An illustrative report for one Azure subscription. The configuration is synthetic and the findings come from a reproduced CloudWellArchitected readback.
Address public network access and the TLS minimum together. Verify the private connection path and client compatibility before tightening either setting.
SEC-005 · Storage permits public network accessEvidence Public network access is enabled on stexampleuntagged.
Next step Confirm the consumers, test a private path, then restrict public network access and verify from an approved client.
SEC-004 · Storage allows a TLS 1.0 minimumEvidence The same account reports a TLS 1.0 minimum. The paired account reports TLS 1.2.
Next step Test client compatibility, raise the minimum, and recapture the setting.
SEC-002 · The hub has no linked private DNS zonesEvidence The configuration shows zero links for vnet-example-hub and two for the spoke.
Next step Confirm which endpoints need to resolve from the hub and test the intended DNS path from that network.
OPS-002 · Audit log retention is below the baselineEvidence DefaultWorkspace-example reports 30 days against the catalog’s 90-day floor.
Next step Confirm the retention requirement, estimate incremental volume charges, and verify the revised setting.
GOV-001 · Resource ownership is missingEvidence stexampleuntagged has no Owner tag.
Next step Assign a responsible team and verify that the team accepts ownership.
COST-002 · Cost attribution is missingEvidence The same account has no CostCenter tag.
Next step Apply the approved cost center and confirm that charges appear under it in cost reporting.
Request a dated restore exercise with measured recovery time and data loss, plus a representative load test and its workload metrics.
Request privilege elevation evidence, workload-side DNS tests, diagnostic settings, and proof that expected logs arrived.
The fixture contains configuration without billing or usage data. Use a billing export and retention volumes to estimate the change in monthly spend.
Automated findings describe what the capture shows. Remediation priorities and next steps illustrate the architect’s judgment and would be confirmed with the workload owner.